Authentication, AWS subdomains and more gentle identifier escaping

This PR adds 3 new features, which all touch the same code. Splitting them into 3 pull requests would make them easier to review, but also guarantee merge conflicts :-)

 1. The mechanism for escaping file identifiers was too rough on AWS (`Fog::AWS.escape(identifier)`) – if the identifier was a path, and not just a filename, the forward slashes would be escaped, and all files stored in the bucket root path. See https://github.com/bquorning/remote_files/commit/authentication~3.
 2. Prefer creating AWS URLs with subdomain, instead of a folder. Code copied almost directly from [CarrierWave](https://github.com/jnicklas/carrierwave/blob/master/lib/carrierwave/storage/fog.rb#L297). See https://github.com/bquorning/remote_files/commit/authentication~2.
 3. If a file isn't public, the URL should include an authentication token with a limited TTL. Copied even more almost directly from [CarrierWave](https://github.com/jnicklas/carrierwave/blob/master/lib/carrierwave/storage/fog.rb#L139). See https://github.com/bquorning/remote_files/compare/authentication~2...authentication.

Some tests are missing, and the `authenticated_url_expiration` options isn’t documented or even used properly – it should probably be moved to `configuration.rb`. Let me know what you think.

@staugaard, @morten